CVE-2026-45047 bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding
An unauthenticated remote attacker can cause a fatal out-of-memory denial of service by sending an unbounded JSON payload to the API handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45047?
CVE-2026-45047 is a high-severity denial of service vulnerability in xddxdd bird-lg-go, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5.
Weakness: CWE-400
Which versions are affected by CVE-2026-45047?
3 open source packages ship an affected version, including github.com/xddxdd/bird-lg-go.
| Package | Affected | Fixed in |
|---|---|---|
github.com/xddxdd/bird-lg-go Go | All versions | 0.0.0-20260507060110-0ff87024cb9e |
github.com/xddxdd/bird-lg-go Go | All versions | 0.0.0-20260507060110-0ff87024cb9e |
github.com/xddxdd/bird-lg-go Go | All versions | 0.0.0-20260507060110-0ff87024cb9e |
How do I fix CVE-2026-45047?
Upgrade github.com/xddxdd/bird-lg-go to 0.0.0-20260507060110-0ff87024cb9e or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45047 being exploited?
There is no known exploitation of CVE-2026-45047 in the wild and no public exploit code.
Sources
Also known as GHSA-39qr-rc93-vhqm, GO-2026-5077.